---
title: Assessing your third-party risk
description: Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/governance-risk-compliance/third-party-risk-management/tprm-assessing-tpr.html
release: australia
product: Third-party Risk Management
classification: third-party-risk-management
topic_type: concept
last_updated: "2026-09-10"
reading_time_minutes: 17
breadcrumb: [Third-party Risk Management, Governance, Risk, and Compliance]
---

# Assessing your third-party risk

Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships. The information gathered from internal questionnaires, external questionnaires, and documentation requests helps you to understand the third party's risk profile, determine the appropriate risk mitigation strategies, and determine whether the third party or engagement meets all necessary compliance requirements.

## Responding to questionnaires

The following processes outline the timing and methods for responding to internal and external questionnaires:

-   **Inherent Risk Questionnaire \(IRQ\) process**

    The following infographic shows the IRQ process.

    \[Omitted image "mmasset0020741-IRQ-process-landing.png"\] Alt text: Infographic that shows the IRQ process in the due diligence workflow. For the text description, refer to the process steps that follows.

    The following are the steps of the IRQ process.

    1.  After the due diligence request is approved by the Third-party risk \(TPR\) manager \[sn\_vdr\_risk\_asmt.vendor\_risk\_manager\] or TPR assessor \[sn\_vdr\_risk\_asmt.vendor\_assessor\] that has been assigned as the owner of the due diligence request, they select an IRQ and attach it to an internal assessment.
    2.  The system sends out an email notification to the employee that has been assigned as the IRQ assessor \[snc\_internal\].
    3.  The IRQ assessor completes the internal assessment by responding to the IRQ.
    4.  After the IRQ assessor submits their responses and the TPR manager or owner reviews and closes the IRQ, the due diligence request state updates from IRQ in progress to IRQ in review.
    **Note:** Don’t change a questionnaire template after it has been sent out as part of an internal assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown to the IRQ assessor. To send an updated version, you must cancel the existing questionnaire by deassociating it from the internal assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-questionnaire-template.md), [Create a questionnaire or document request template using the Designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-question-template.md), and [Create a TPRM SAE questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-sae-q-template.md).

    Based on the information gathered, the TPR manager and their team assess the potential risks that are associated with the engagement. They evaluate factors such as the financial stability, the operational capacity, the adherence to quality standards, the compliance with regulations, and the third party's ability to meet delivery timelines. This assessment helps the team to understand the third party's risk profile and to determine the appropriate risk mitigation strategies.

    For more information about IRQs or internal assessments, see [Create an internal assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-create-int-assessment.md) and [Respond to an internal assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-irq-respond-to.md).

-   **Third-party \(TP\) element collection process: Collect TP element information**

    Collecting TP elements is optional. Depending on your due diligence process, you can add elements directly in the Elements grid, or the system can create a task that assigns the work to the due diligence requester or to a third-party or engagement contact.

    **Note:** In previous releases, TP elements were created by manually reviewing responses to a completed collection questionnaire. TP elements are now created directly, either in the Elements grid or through a collection task.

    The TP element collection process includes the following steps.

    1.  If AI assets are involved in the engagement, the due diligence requester selects **AI assets involved** when creating the due diligence request.
    2.  The due diligence request owner selects **Start onboarding**. If the requester selected **AI assets involved**, the system also creates an internal task that assigns the due diligence requester to add AI use case elements.
    3.  To collect more elements from the third party or engagement, the due diligence request owner selects **Start collection**. The system creates a task and assigns it to a third-party or engagement contact.
    4.  The third-party or engagement contact, or the due diligence requester for an internal task, completes the task by adding or editing elements in the Elements grid. For more information, see [Complete an element collection task](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-elements-task-manage.md) and [Manage elements in the grid](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-elements-grid-manage.md).
    5.  When ready to begin element-level assessments, the due diligence request owner selects **Start due diligence**. An assessment is created only for elements marked **Assessment required**.
    This is an optional process for collecting TP elements and assigning them to engagements so that they can be assessed as part of the overall due diligence workflow. For more information on TP elements, see [Monitoring third-party elements](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-monitor-tp-elements.md).

-   **Due diligence process: Compliance verification**

    The following infographic shows the due diligence process.

    \[Omitted image "mmasset0020742-due-diligence-process-vertical.png"\] Alt text: Infographic that shows the due diligence process in the due diligence workflow. For the text description, refer to the process steps that follows.

    The following are the steps of the Due diligence process.

    1.  After the IRQ process or TP element collection process is completed, the TPR manager or owner selects questionnaires and requests for documentation to attach to external assessments for sending to the third party or engagement. For more information on creating assessments, see [Create an external assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-create-assessment.md) and [Third-party risk assessment form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-create-assessment-form.md).

        **Note:**

        -   If you completed the optional TP element collection process, selecting **Start due diligence** automatically creates an assessment for each element marked **Assessment required**. This scope is available only when the third party uses the Smart Assessment Engine. Third-party and engagement contacts can respond to these element-scoped assessments in the third-party portal the same way they respond to engagement-scoped assessments.
        -   If the **SBOM required** field was selected on the due diligence request and the engagement uses the Smart Assessment Engine, the system automatically includes an SBOM questionnaire in the external assessment. For more information, see [Collecting software bill of materials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-sbom.md).
    2.  The system sends out an email notification to the third-party and engagement contact that has been assigned each assessment.

        **Note:** Don’t change a questionnaire template after it has been sent out as part of an external assessment. Instead, duplicate the template by making a copy and make your changes in the new copy. If you update a questionnaire after it has been sent out, the changes won't appear in the version shown in the third-party portal. To send an updated version, you must cancel the existing questionnaire by deassociating it from the external assessment and then add the questionnaire using the updated template. For more information, see [Create a questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-questionnaire-template.md), [Create a questionnaire or document request template using the Designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-question-template.md), and [Create a TPRM SAE questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-sae-q-template.md).

    3.  After the third-party and engagement contacts submit their responses, the TPR manager or owner reviews and verifies all the required information was provided in the assessments. Issues and tasks are created if remediation or additional information is required.
    4.  The TPR manager or owner approves and closes each assessment.
    The TPR manager can develop assessment templates to simplify and automate the process of determining which questionnaires and document requests to send to a third party of this type. The TPR administrator can define questionnaire templates, document request templates, and then the TPR manager can group them into an assessment template. Your organization can reuse the template to send the questionnaires and document requests to similar third parties in future assessments. For more information about templates, see [Create an external assessment template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-vendor-risk-assess-temp.md), [Create a questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-questionnaire-template.md), and [Create a questionnaire or document request template using the Designer](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-question-template.md).

    The TPR manager and their team use the third party's responses and internal analysis to determine whether the third party meets all the necessary compliance requirements. These requirements could include verifying the third party's compliance with applicable laws and regulations, such as environmental regulations, labor laws, and anti-corruption policies.

    **Note:** The third-party risk assessor, manager, or admin can answer questions, modify responses, and submit external questionnaires on behalf of third parties or engagements. For more information, see [Respond to a questionnaire for a third party or engagement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-respond-for-tp.md).

    Due to the sensitive nature of the items involved, the TPR manager and their team evaluate the third party's data security and privacy practices. They assess the third party's information security measures, data protection policies, access controls, and vulnerability management processes. If the third party has access to proprietary information or customer data, they might require the third party to undergo a cybersecurity audit or provide evidence of their data protection measures.

    For more information about reviewing responses, see [Review responses to external questionnaires](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-ws-assessment-rvw-response.md).

    **Note:** Your TPR assessor can export **Responses received** or **Returned** questionnaires to Microsoft Excel spreadsheets when using the Classic assessment engine. This option enables your organization to use the spreadsheet environment to review the questions and answers. For more information about exporting questionnaire responses, see [Export questionnaire responses to a spreadsheet](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/export-q-and-a-to-excel.md).


## Pre-populate questionnaires with responses

The TPR manager or TPR assessor can pre-populate questionnaires for third parties and engagements with responses from complete questionnaires associated with the same third party. After sending out the assessment, the questionnaire is pre-populated with all responses from the most recent completed version of that questionnaire, regardless of whether the original associated assessment is completed. This is helpful for questionnaires where responses are expected to remain consistent, expediting the process and enabling third-party contacts to review and update responses only if necessary. For more information on creating assessments, see [Create an external assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-create-assessment.md).

**Important:** When the TPR manager or TPR assessor adds a questionnaire to an assessment, they have the option to select or deselect the Include previous responses option on the questionnaire page. The option can’t be changed after the questionnaire is sent to the third party. For more information, see [Create a questionnaire or document request template](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-questionnaire-template.md) and [Assessment metric type form](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-create-q-template-form.md).

When a third-party or engagement contact opens a pre-populated questionnaire in the Third-party portal, they receive a notification that the responses were copied from an earlier questionnaire. The notification includes a link to the assessment that supplied the responses and its last updated date as shown in the following example.

\[Omitted image "tprm-pre-populate-q-aire.png"\] Alt text: Notification that the responses are copied from an earlier questionnaire.

Limitations:

-   Some question types and their responses can’t be pre-populated such as the attachment, duration, and signature question types. These question responses remain blank and previous responses aren’t included.
-   Responses are copied from the original assessment \(Assessment A\) to the newer assessment \(Assessment B\) one time. This copying occurs when Assessment B is submitted to a third party or an engagement. Any changes you make to Assessment A afterward won't be reflected in Assessment B. Both assessments remain separate.
-   Inactive and retired metrics are excluded when copying responses between assessments.

If the Smart Assessment Response Assist skill is active and template categories are configured for AI-assisted responses, internal and external assessment respondents can use ServiceNow Otto for Third-party Risk Management \(TPRM\) to generate draft responses from Document Management System documents and previously completed assessments. For more information, see [AI-assisted questionnaire pre-fill using the Document Management System](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-dms-sae.md).

## Issues and tasks

The role of TPR assessor \[sn\_vdr\_risk\_asmt.vendor\_assessor\] is required to create and manage both tasks and issues.

The TPR manager, TPR assessor, or contract negotiator can create tasks to help ensure that a team member or the third-party contact responds to concerns about the questionnaire responses or requested documents. They can manage existing tasks to verify that the assigned team member or third-party contact responds to a task and updates it as needed. For more information about creating and managing issues, see [Create a task for a third party or engagement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-ws-task-create.md) and [Manage a task for a third party or engagement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-ws-task-manage.md).

For follow-up work that stays within your own organization instead of going to a third-party contact, TPR assessors \[sn\_vdr\_risk\_asmt.vendor\_assessor\] can create internal tasks and assign them to any internal user. Internal tasks aren't visible in the Third-party portal and can be used for a variety of follow-up needs. For more information, see [Create a task for an internal user](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-internal-tasks.md).

Before creating an issue manually, TPR assessors \[sn\_vdr\_risk\_asmt.vendor\_assessor\] can use ServiceNow Otto for TPRM to generate a quick summary of an existing issue, or to get AI-driven recommendations for potential issues based on assessment responses and historical data. For more information, see [Generate a summary of a TPRM issue](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-a-summary-of-issue.md) and [Generate issue recommendations for TPRM](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/create-recommendation-tprm-issue.md).

**Note:** Depending on your license, you will have access to certain application features, generative AI skills, agentic workflows, and AI agents. For more information, see [ServiceNow product tiers](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/intelligent-experiences/ai-native-sku-overview.md).

The TPR manager, TPR assessor, or contract negotiator can also create an issue manually to help ensure the teams concerns about a third party or engagement are remediated. They can also manage the existing issues to verify that they’re understood, shared with the correct persons, and are acted on as needed. For more information about creating and managing tasks, see [Create an issue for a third party or engagement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-ws-issue-create.md) and [Manage issues](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-ws-issue-manage.md).

## Additional assessment actions

The TPR manager, due-diligence request owner, or contract negotiator may need to reopen an assessment because there’s new information available that impacts the engagement or some other change has occurred. For more information, see [Why you conduct due diligence](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/vrm-due-diligence-why.md).

If the TPR manager, due-diligence request owner, or contract negotiator must gather more information from an engagement, they can send out an additional questionnaire or document request by reopening an assessment and doing the following actions:

1.  Navigate to the Due diligence request record page by selecting the relevant **DDR** number.
2.  View the related third-party risk assessment by selecting the **VRA** number on the **External assessments** tab.
3.  Select **Re-open**.

The due diligence request state updates from Ready for TPRM approval to Due diligence. The TPR manager, owner, or contract negotiator can request questionnaires and document requests as needed. For more information, see [Reopen an assessment](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/trpm-reopen-assessment.md).

If the TPR manager, due-diligence request owner, or contract negotiator doesn’t require an assessment for an ongoing engagement or requires a quick close for onboarding or renewing an engagement, they can cancel an assessment by doing the following actions:

1.  Navigate to the Due diligence request record page by selecting the relevant **DDR** number.
2.  View the related third-party risk assessment by selecting the **VRA** number on the **External assessments** tab.
3.  Select **Cancel**.

Even if one or all assessments are canceled, the due diligence request proceeds to the Approval process.

**Related topics**  


[Collecting software bill of materials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-sbom.md)

[Request a software bill of materials from an engagement](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-sbom-collect.md)

[AI-assisted questionnaire pre-fill using the Document Management System](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/governance-risk-compliance/third-party-risk-management/tprm-dms-sae.md)